The flaw allows an authenticated user to alter the company ID parameter in a POST request to the backend, bypassing the application's verification that the requested ID matches the user's session. By doing so, the attacker can view and potentially modify sensitive data belonging to other companies hosted under the same subdomain. The exploit is a classic authorization bypass (CWE‑639) that grants unauthorized access to confidential customer information, such as billing records, and may enable the alteration of third‑party data.

The affected product is Adiss Biloop. Availability details are not provided, so all deployed instances of the application that host multiple tenants within the same sub until a patch is applied.

The CVSS score of 9.3 classifies the vulnerability as critical. The EPSS score of less than 1% indicates a low yet non‑zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session; once the company ID parameter, the application allows access to other tenants’ data without further checks. The attack path is straightforward and does not need elevated privileges outside the web application.